CyberRota Analysis
AI-GeneratedThe dd-trace-rs library, used for Datadog application performance monitoring in Rust, is vulnerable to a denial-of-service attack due to improper handling of the W3C tracestate header in versions 0.1.0 to 0.3.3. An unauthenticated remote attacker can exploit this flaw by sending a large dd=... entry, leading to excessive CPU and memory consumption on affected services. Organizations utilizing this library should prioritize upgrading to version 0.3.3 or later to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3.